From f8a4c7aab5fa9326fb5ea2eab37b389671ac8143 Mon Sep 17 00:00:00 2001 From: bpatel Date: Fri, 7 Jun 2019 13:49:49 -0700 Subject: [PATCH] flake8 --- .gitignore | 1 + package/bin/detect.py | 99 ++++++++++++++++++------------------------- 2 files changed, 43 insertions(+), 57 deletions(-) diff --git a/.gitignore b/.gitignore index 19f0ec8748..7bfd95b2b8 100644 --- a/.gitignore +++ b/.gitignore @@ -99,3 +99,4 @@ venv.bak/ # mypy .mypy_cache/ +package/bin/sftp-config.json \ No newline at end of file diff --git a/package/bin/detect.py b/package/bin/detect.py index 0b000bb5a5..9ed72e526b 100644 --- a/package/bin/detect.py +++ b/package/bin/detect.py @@ -7,64 +7,51 @@ from splunklib.searchcommands import dispatch, GeneratingCommand, Configuration, import splunk.mining.dcutils import time + @Configuration(streaming=True, local=True) class DetectCommand(GeneratingCommand): - ''' - Class for the runstory SPL command - ''' + logger = splunk.mining.dcutils.getLogger() - - story = Option(require = True) - - risk = Option(require = True) - - + story = Option(require=True) + risk = Option(require=True) earliest_time = Option(doc=''' **Syntax:** **domainlist=**** **Description:** CSV file from which repeated random samples will be drawn - ''', name = 'earliest_time', require = True) - + ''', name='earliest_time', require=True) latest_time = Option(doc=''' **Syntax:** **domainlist=**** **Description:** CSV file from which repeated random samples will be drawn - ''', name = 'latest_time', require = True) + ''', name='latest_time', require=True) def generate(self): story = self.story - risk = self.risk earliest_time = self.earliest_time latest_time = self.latest_time - detection_searches_to_run = [] - investigative_searches_to_run = [] + # investigative_searches_to_run = [] support_searches_to_run = [] runstory_results = {} - - port = splunk.getDefault('port') service = splunklib.client.connect(token=self._metadata.searchinfo.session_key, port=port) f = open("/opt/splunk/etc/apps/DA-ESS-ContentUpdate/bin/errors2.txt", "w") f.write("Starting run story") - searches_to_run = [] - context_searches_to_run = [] - investigative_searches_to_run = [] - support_searches_to_run = [] - runstory_results = {} savedsearches = service.saved_searches for savedsearch in savedsearches: content = savedsearch.content - if content.has_key('action.escu.analytic_story') and story in content['action.escu.analytic_story'] and content['action.escu.search_type'] == 'support': + if 'action.escu.analytic_story' in content and story in content['action.escu.analytic_story'] and \ + content['action.escu.search_type'] == 'support': support_data = {} support_data['search_name'] = content['action.escu.full_search_name'] support_data['search_description'] = content['description'] support_data['search'] = content['search'] support_searches_to_run.append(support_data) - if content.has_key('action.escu.analytic_story') and story in content['action.escu.analytic_story'] and content['action.escu.search_type'] == 'detection': + if 'action.escu.analytic_story' in content and story in content['action.escu.analytic_story'] and \ + content['action.escu.search_type'] == 'detection': search_data = {} search_data['search_name'] = content['action.escu.full_search_name'] search_data['search_description'] = content['description'] @@ -75,27 +62,24 @@ class DetectCommand(GeneratingCommand): search_data['mappings'] = json.loads(content['action.escu.mappings']) detection_searches_to_run.append(search_data) - ''' - if content.has_key('action.escu.analytic_story') and story in content['action.escu.analytic_story'] and content['action.escu.search_type'] == 'investigative': - investigative_data = {} - investigative_data['search_name'] = content['action.escu.full_search_name'] - investigative_data['action.escu.fields_required'] = content['action.escu.fields_required'] - investigative_data['search'] = content['search'] - investigative_searches_to_run.append(investigative_data) - ''' + # if content.has_key('action.escu.analytic_story') and story in content['action.escu.analytic_story'] and \ + # content['action.escu.search_type'] == 'investigative': + # investigative_data = {} + # investigative_data['search_name'] = content['action.escu.full_search_name'] + # investigative_data['action.escu.fields_required'] = content['action.escu.fields_required'] + # investigative_data['search'] = content['search'] + # investigative_searches_to_run.append(investigative_data) # Run all Support searches - - support_search_name = [] for search in support_searches_to_run: - kwargs = { "exec_mode": "normal", "earliest_time": "-31d" , "latest_time": "-1d"} + kwargs = {"exec_mode": "normal", "earliest_time": "-31d", "latest_time": "-1d"} spl = search['search'] - #f.write("Support search->>>>> " + spl + "\n" ) + # f.write("Support search->>>>> " + spl + "\n" ) if spl[0] != "|": spl = "| search %s" % spl job = service.jobs.create(spl, **kwargs) - #time.sleep(2) + # time.sleep(2) while True: job.refresh() if job['isDone'] == "1": @@ -107,10 +91,9 @@ class DetectCommand(GeneratingCommand): for search in detection_searches_to_run: runstory_results['detection_results'] = [] - item_count = 0 - kwargs = { "exec_mode": "normal","earliest_time": earliest_time, "latest_time": latest_time} + kwargs = {"exec_mode": "normal", "earliest_time": earliest_time, "latest_time": latest_time} spl = search['search'] - #f.write("detection search->>>>> " + spl + "\n" ) + # f.write("detection search->>>>> " + spl + "\n" ) if spl[0] != "|": spl = "| search %s" % spl job = service.jobs.create(spl, **kwargs) @@ -122,11 +105,11 @@ class DetectCommand(GeneratingCommand): break job_results = splunklib.results.ResultsReader(job.results()) - #f.write(str(type(job_results))) + # f.write(str(type(job_results))) runstory_results['detection_result_count'] = job['resultCount'] if job['resultCount'] > "0" and risk == "true": - detection_results=[] + detection_results = [] common_field = [] runstory_results['common_field'] = [] @@ -145,17 +128,21 @@ class DetectCommand(GeneratingCommand): common_field.append(value) for i in common_field: - f.write("-------->>>>>>>"+ str(i)+ "\n\n") - create_risk_score="|makeresults" +"| eval search_name=\"" + search['search_name'] +"\"" + "| eval risk_object=\"" + str(i) +"\"" + "|eval risk_score = \""+ search['risk_score'] + "\"" "| eval risk_object_type=\"" + search['risk_object_type'] +"\"" +"| sendalert risk" + f.write("-------->>>>>>>" + str(i) + "\n\n") + create_risk_score = "|makeresults" + "| eval search_name=\"" + \ + search['search_name'] + "\"" + "| eval risk_object = \"" + \ + str(i) + "\"" + "| eval risk_score = \"" + search['risk_score'] + \ + "\"" + "| eval risk_object_type = \"" + search['risk_object_type'] + \ + "\"" + "| sendalert risk" - kwargs = { "exec_mode": "normal","earliest_time": earliest_time, "latest_time": latest_time} + kwargs = {"exec_mode": "normal", "earliest_time": earliest_time, "latest_time": latest_time} job = service.jobs.create(create_risk_score, **kwargs) while True: - job.refresh() - if job['isDone'] == "1": - break + job.refresh() + if job['isDone'] == "1": + break runstory_results['common_field'] = common_field runstory_results['detection_results'] = detection_results runstory_results['detection_search_name'] = search['search_name'] @@ -167,9 +154,9 @@ class DetectCommand(GeneratingCommand): '_time': time.time(), '_raw': runstory_results, 'sourcetype': "_json", - 'story':story, - 'support_search_name' : runstory_results['support_search_name'], - 'common_field' : runstory_results['common_field'], + 'story': story, + 'support_search_name': runstory_results['support_search_name'], + 'common_field': runstory_results['common_field'], 'mappings': runstory_results['mappings'], 'detection_search_name': runstory_results['detection_search_name'], 'detection_result_count': runstory_results['detection_result_count'], @@ -178,10 +165,8 @@ class DetectCommand(GeneratingCommand): 'risk_object': runstory_results['risk_object'] } - - if job['resultCount'] > "0" and risk == "false": - detection_results=[] + detection_results = [] common_field = [] runstory_results['common_field'] = [] @@ -204,9 +189,9 @@ class DetectCommand(GeneratingCommand): '_time': time.time(), '_raw': runstory_results, 'sourcetype': "_json", - 'story':story, - 'support_search_name' : runstory_results['support_search_name'], - 'common_field' : runstory_results['common_field'], + 'story': story, + 'support_search_name': runstory_results['support_search_name'], + 'common_field': runstory_results['common_field'], 'mappings': runstory_results['mappings'], 'detection_search_name': runstory_results['detection_search_name'], 'detection_result_count': runstory_results['detection_result_count'],